CORS write capability

Basically begin able to cros write will allow developers to develop 3rd party clients for sites that dont use merger hubs

like for example:
zerotalk custom client
or zeromail client or a multi mail client that wants to support zeromail

i can understand the possible security concerns but it should be like how it is for "admin perm"
something that's marked as somewhat dangerous
we already have admin so why not this? another permission node to allow sites to fine tune things

The issue names no files, tests, or entry points. Start by locating the existing admin-permission handling and the project's cross-origin request path, then clarify the security model and permission semantics before proposing an implementation. Done would include an agreed permission design, implementation, and tests for allowed and denied third-party writes.

索引モデルが issue の本文から書いたものです。